ExamFinch.com My Study

Study guide

1.1 Configuring Workload Observability

Practice this exam

AWS Certified CloudOps Engineer – Associate SOA-C03

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Monitoring & Observability Infrastructure

1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms

2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation

2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda

3 Chapter 3: Performance Optimization for Compute, Storage & Databases

3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance

4 Chapter 4: Compute & Database Scalability and Elasticity

4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB

5 Chapter 5: High Availability, Fault Tolerance & Load Balancing

5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments

6 Chapter 6: Backup, Data Protection & Disaster Recovery

6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience

7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK

7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures

8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC

8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows

9 Chapter 9: Systems Manager & Event-Driven Operations Automation

9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation

10 Chapter 10: Identity, Access Management & Governance

10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs

11 Chapter 11: Data Security, Encryption & Vulnerability Management

11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings

12 Chapter 12: VPC Architecture, Endpoints & Network Protection

12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing

13 Chapter 13: DNS, Route 53 Routing & Content Delivery

13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator

14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity

14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting

1.1 Configuring Workload Observability

Key Takeaways Explain This Topic AI

CloudWatch standard monitoring publishes at 5-minute intervals at no charge, while detailed monitoring publishes at 1-minute intervals for EC2 instances and Auto Scaling launch templates

High-resolution custom metrics support collection down to 1-second intervals via PutMetricData, with retention tiers: 1-second (3 hours), 1-minute (15 days), 5-minute (63 days), and 1-hour (455 days)

Metric filters extract structured metrics from CloudWatch Logs using filter patterns, and configuring a default value of 0 prevents sparse metrics and false alarms

AWS CloudTrail separates management events (control plane, enabled by default) from data events (S3 object-level and Lambda invocations, charged per event), with log file integrity validated via SHA-256 and RSA signatures

Amazon Managed Service for Prometheus (AMP) provides serverless, Prometheus-compatible time-series storage scraped by AWS Distro for OpenTelemetry (ADOT) and queried via PromQL

Last updated: September 2026

Workload Observability Across Compute, Serverless, and AI/ML

Production cloud operations require full-stack visibility across compute, serverless, and AI/ML workloads. In AWS, observability relies on metrics, logs, and traces. Effective monitoring configures workload-specific telemetry reflecting true operational health.

For Amazon EC2 compute workloads , the AWS hypervisor monitors virtual hardware metrics (CPU, basic disk, network) without host-installed agents. However, guest operating system internals—memory utilization, file system space, and network sockets—require the unified CloudWatch Agent.

For serverless architectures , AWS Lambda automatically emits operational metrics to Amazon CloudWatch:

Invocations : Total execution requests triggered by event sources.

Errors : Invocations resulting in unhandled exceptions, runtime crashes, or timeouts.

Duration : Execution elapsed wall-clock time in milliseconds.

Throttles : Invocations rejected due to exceeding reserved concurrency or account limits.

ConcurrentExecutions : Simultaneous active execution environments.

Amazon API Gateway monitors API traffic via Count (request volume), 4XXError (client errors), 5XXError (backend failures or gateway timeouts), Latency (total response time from client request to delivery), and IntegrationLatency (time spent waiting for the backend integration to respond). Comparing Latency against IntegrationLatency isolates whether delays originate in backend code or API Gateway overhead.

For AI/ML workloads on Amazon SageMaker real-time inference endpoints ( AWS/SageMaker namespace), primary operational metrics include Invocations , ModelLatency (inference processing duration inside the container), OverheadLatency (request payload handling and network transmission), and hardware accelerators GPUUtilization and GPUMemoryUtilization .

CloudWatch Metrics Architecture & Storage Retention Tiers

CloudWatch Metrics stores timestamped time-series data defined by a MetricName , Namespace (e.g., AWS/EC2 or custom App/Billing ), and up to 30 Dimensions (identifying key-value pairs).

EC2 supports two monitoring frequencies:

Standard Monitoring : 5-minute metric publication included at no additional charge.

Detailed Monitoring : 1-minute metric publication enabled per instance or launch template for an additional fee, allowing Auto Scaling groups to respond quickly to traffic surges.

Custom Metrics & High-Resolution Publishing

Workloads emit custom metrics using the PutMetricData API, specifying namespace, metric name, dimensions, timestamp, value, and unit (such as Seconds , Percent , or Bytes ). Setting --storage-resolution 1 configures high-resolution metrics with 1-second intervals (standard metrics use 60-second intervals).

CloudWatch retains data across four distinct duration tiers:

  • Resolution Tier Retention Period Aggregation & Rollup Behavior
  • 1-second 3 hours Full sub-minute resolution for debugging transient latency spikes
  • 1-minute 15 days 1-minute intervals for active operational alerting
  • 5-minute 63 days 5-minute intervals for medium-term capacity planning
  • 1-hour 455 days (15 months) 1-hour rollup intervals for long-term historical analysis
  • CloudWatch Logs & CloudWatch Logs Insights

Amazon CloudWatch Logs organizes log ingestion through two core components:

Log Groups : Define retention rules (1 day to 10 years, or Never Expire), AWS KMS customer managed key (CMK) encryption, and access policies.

Log Streams : Discrete sequences of log events from the same source (such as an EC2 instance, ECS task, or Lambda container).

Metric Filters and Transformations

Metric filters scan incoming logs in real time against filter patterns:

  • JSON pattern: { $.statusCode = 500 || $.statusCode = 502 }
  • Space-delimited pattern: [ip, user, timestamp, request, status_code = 5*, response_size]

The metric transformation maps matched tokens to a custom metric. Administrators must set the Default Value parameter to 0 . Without a default value, filters emit nothing when logs contain no matching events, creating sparse metrics that leave alarms in INSUFFICIENT_DATA or stale states.

CloudWatch Logs Insights

Logs Insights provides an interactive query syntax to analyze logs across groups:

fields : Selects fields to display.

filter : Evaluates boolean or regex conditions.

stats : Calculates aggregations grouped by time bins.

  • sort and limit : Orders and caps result sets. fields @timestamp, @message, status_code, response_time
  • | filter status_code >= 500
  • | stats count() as error_count by bin(5m)
  • | sort error_count desc
  • | limit 20
  • AWS CloudTrail: Governance, Data Events & CloudTrail Lake

AWS CloudTrail audits API calls across accounts:

Management Events : Record control plane operations (e.g., RunInstances , CreateBucket ). Captured by default across all Regions in a 90-day free event history.

Data Events : Record high-volume data plane operations (e.g., S3 GetObject / PutObject , Lambda InvokeFunction ). Disabled by default; billed per event.

Multi-Region trails record events across all Regions and capture global services (IAM, STS, CloudFront) in us-east-1 . Log File Integrity Validation generates SHA-256 digest files signed with RSA keys, enabling cryptographic tampering verification via aws cloudtrail validate-logs . CloudTrail Lake provides a managed SQL data lake for querying audit logs with configurable retention up to 10 years (3,653 days).

Amazon Managed Service for Prometheus (AMP)

Amazon Managed Service for Prometheus (AMP) delivers serverless, scalable, Prometheus-compatible monitoring for containerized workloads. The AWS Distro for OpenTelemetry (ADOT) collector runs as an EKS DaemonSet, scraping Prometheus endpoints and forwarding metrics to AMP via remote_write with AWS SigV4 authentication. AMP evaluates alerting and recording rules using native PromQL, routing alerts to Amazon SNS topics.

Operational Best Practices

Batch Custom Metrics : Batch up to 1,000 metrics or 1 MB per PutMetricData call, or use Embedded Metric Format (EMF) via logs to avoid API throttling.

Log Retention Governance : Define explicit log retention policies (such as 30 or 90 days) in Infrastructure as Code to eliminate unbounded storage costs.